Security Specification

Zero-Retention PII & Secret Redaction for LLM Payloads

Routing raw customer interactions through third-party LLM providers (OpenAI, Anthropic, Google) introduces immediate compliance liabilities under GDPR, HIPAA, and SOC2. Prompts frequently contain Social Security numbers, credit card data, session bearer tokens, and corporate API keys.

The Compliance Exposure
Risk: Cleartext transmission of customer PII in third-party LLM training/logging pipelines
In-Memory LLM Scrubbers: Slow (600–1,200ms latency), non-deterministic, cost 2x tokens

The Fix: Sub-Millisecond HyperScan Regex Scrubbing

Oridio utilizes a parallelized Rust regex engine compiled to Ahead-of-Time (AOT) WebAssembly directly on global edge proxies. Over 40 built-in PII and secret patterns are inspected in under 0.7 milliseconds (p50). Sensitive data is reversibly replaced with cryptographic surrogates before upstream dispatch:

# Python: OpenAI SDK with Zero-Retention PII Scrubbing
import openai

client = openai.OpenAI(
  base_url="https://proxy.oridio.org/v1",
  default_headers={
    "X-Oridio-Auth": "ord_live_...",
    "X-Oridio-Policy": "strict-pii-scrub",
    "X-Oridio-Redact-Types": "SSN,CREDIT_CARD,API_KEY,EMAIL"
  }
)

Live Transformation Comparison

Inbound Application Payload
"User SSN is 000-12-3456 and key is sk-live-9823f0..."
Proxied to Upstream LLM
"User SSN is [REDACTED_SSN_1] and key is [REDACTED_SECRET_1]"

For combined defense against adversarial input manipulation, see our Prompt Injection Defense filter.

Installation & Setup

Oridio can be integrated either as a drop-in HTTP proxy without modifying your agent codebase, or via our official language bindings for programmatic telemetry and fine-grained Wasm triggers.

$pip install oridio-python && npm install @oridio/sdk
Step 1: Set Proxy Base URL

Route OpenAI/Anthropic SDK client requests through https://proxy.oridio.org/v1.

Step 2: Add Auth Header

Supply your Oridio Master Key via header X-Oridio-Auth: ord_live_....

Architecture & Deep Dive

The Oridio security runtime operates as an out-of-band Layer 7 data plane. Rather than relying on non-deterministic LLM-as-a-judge prompts, security constraints are compiled into Ahead-Of-Time (AOT) WebAssembly binaries evaluated at bare-metal speeds.

Near-Native Wasm
< 0.7ms

P50 evaluation overhead per token packet.

Fail-Closed SLA
99.99%

Global Anycast edge proxy availability.

State Locking
Redlock

Distributed Redis mutex for swarms.

Zero Egress Leakage Guarantee: When a policy trips or a prompt injection signature is detected, Oridio severs the network socket instantly before any data traverses to the upstream provider.

Sample Code & Implementation

from oridio import OridioClient
from langgraph.graph import StateGraph

# Initialize Oridio Edge Gateway client
client = OridioClient(api_key="ord_live_7x9k2m...")

# Wrap your state graph with zero-trust proxy
graph = StateGraph(AgentState)
secure_graph = client.wrap_graph(
    graph,
    budget_limit_usd=50.00,
    pii_redaction=True,
    anomaly_detection=True
)

Interactive Runtime Playground

Edge Mode: Active
{"agent": "finance-bot", "query": "Transfer SSN 000-12-3456"}
{"agent": "finance-bot", "query": "Transfer SSN [REDACTED_SSN]"}(0.7ms p50)

Frequently Asked Questions

Oridio compiles security policies into Ahead-of-Time (AOT) WebAssembly running directly on global proxy edge nodes. Standard regex and token evaluation adds less than 1 millisecond (p50: 0.7ms, p99: < 5ms).

Need help integrating?

Our runtime engineering team can help pair on your agent topology.

Contact support@oridio.org
Previous (Frameworks)Raw Agent LoopsNext (Wasm Engine) Injection Filter